Sasser worm creator sentenced by German court

Microsoft pays a $370,000 reward to two informants

A German teenager who confessed to creating the Sasser computer worm has been found guilty of three counts of computer sabotage and four counts of data manipulation, and given a suspended sentence of 21 months.

Sven Jaschan, 19, was sentenced at the district court in Verden, Germany, on Friday, according to a statement from the court.

Jaschan will be released on three years' probation. If he commits another crime during the probation period, he will be jailed at a juvenile detention centre to serve the 21-month sentence.

In addition, Jaschan must perform 30 hours of community service in a home for the elderly or a hospital.

Prosecutors had asked the court to impose a two-year sentence, while the defence had asked for one year. The court set the sentence at the upper end of the range because of the considerable energy Jaschan had devoted to developing better and faster versions of the worm, and because he had experienced "mischievous glee" when he was successful in this. The court suspended the sentence because Jaschan had made a full confession and shown that he could modify his behaviour.

Following the conviction, Microsoft, whose software was targeted by the worm, said it will pay a reward of US$250,000 (NZ$370,000), to be shared by two people who helped identify Jaschan as the worm's author. The money will come from the US$5 million Antivirus Reward Programme set up by Microsoft in 2003.

Within two days of the worm's release, Microsoft issued software to help clean up attacked computers, but when this failed to stop the worm's spread, the company began sharing information with the German police, it said in a statement. Jaschan was arrested seven days after releasing the worm.

Jaschan confessed to writing the Sasser worm after he was arrested in May 2004. Sasser crashed hundreds thousands of computers around the world last year by exploiting a flaw in a Windows software component called the Local Security Authority Subsystem Service, or LSASS.